T09 · Insecure Skill Coding Practices
Error
- Location
server.py:248- Finding
Unrestricted Colony Endpoint Polling Enables Blind SSRF
- Content
View full analysis
Vulnerability Details
File Location:
server.py:248-313
Vulnerability Type: Server-Side Request Forgery (SSRF)
Risk Level: HighThe server accepts an arbitrary colony endpoint, stores it without validation, and later issues an HTTP GET request to that endpoint from the server's network context.
python @mcp.tool() def colony_register(name: str, colony_type: str, endpoint: str = "", metadata: str = "{}") -> dict: """Register a new external colony. Args: name: Colony name colony_type: Colony type endpoint: Connection address metadata: Additional JSON metadata """ TYPE_MAP = { "hive": "Another hive", "flower_field": "Data source", "manuka_grove": "Specialist knowledge", "river": "Streaming information", } if colony_type not in TYPE_MAP: return {"error": f"Invalid type {colony_type}"} db = get_db() now = datetime.now(timezone.utc).isoformat() try: meta = json.loads(metadata) except json.JSONDecodeError: meta = {} db.execute( "INSERT OR REPLACE INTO colonies " "(name, type, endpoint, status, last_poll, metadata) " "VALUES (?, ?, ?, 'registered', ?, ?)", (name, colony_type, endpoint, now, json.dumps(meta, ensure_ascii=False)) ) db.execute( "INSERT INTO evolution_log " "(action, target, detail, created_at) VALUES (?, ?, ?, ?)", ( "colony_register", name, json.dumps( {"type": colony_type, "endpoint": endpoint}, ensure_ascii=False ), now ) ) db.commit() db.close() return { "registered": name, "type": colony_type, "display": TYPE_MAP[colony_type], "endpoint": endpoint, } @mcp.tool() def colony_poll(name: str) -> dict: """Probe the status of an external colony.""" db = get_db() row = db.execu ...[truncated 3306 chars]- Remediation
View remediation
Remediation Suggestions
- Permit only explicitly required URL schemes, preferably
https. - Maintain an explicit allowlist of approved destination hostnames and ports.
- Resolve destination hostnames before making requests and reject every address that is loopback, private, link-local, reserved, multicast, or unspecified.
- Explicitly block known cloud metadata destinations, including link-local metadata addresses.
- Disable redirects unless necessary. If redirects are required, resolve and validate every redirect target before following it.
- Protect against DNS rebinding by connecting only to the validated resolved address while preserving the intended TLS hostname.
- Apply outbound firewall or proxy rules so the process cannot reach loopback, private networks, or metadata services unless explicitly required.
- Require authorization for colony registration and polling operations.
- Return a generic failure status rather than exception-type and HTTP-status distinctions that improve the network-scanning oracle.
- Add tests covering encoded IP addresses, IPv6, redirects, user-info URL syntax, alternate ports, mixed-case schemes, and DNS rebinding scenarios.
- Permit only explicitly required URL schemes, preferably